You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@commons.apache.org by pk...@apache.org on 2026/08/31 14:15:23 UTC
(commons-graph) branch feat/use-commons-xml created (now 101c3ac)
This is an automated email from the ASF dual-hosted git repository.
ppkarwasz pushed a change to branch feat/use-commons-xml
in repository https://gitbox.apache.org/repos/asf/commons-graph.git
at 101c3ac Harden XML output via commons-secure-xml
This branch includes the following new commits:
new 101c3ac Harden XML output via commons-secure-xml
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(commons-graph) 01/01: Harden XML output via commons-secure-xml
Posted by pk...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
ppkarwasz pushed a commit to branch feat/use-commons-xml
in repository https://gitbox.apache.org/repos/asf/commons-graph.git
commit 101c3ac0163fe00c8ae858982e7f9e6de233269f
Author: Piotr P. Karwasz <pk...@apache.org>
AuthorDate: Mon Aug 31 15:17:47 2026 +0200
Harden XML output via commons-secure-xml
Create the GraphML exporter's transformer factory through
org.apache.commons:commons-secure-xml. The secure factory enables
FEATURE_SECURE_PROCESSING on the transformers it produces and bounds
their resource usage, regardless of the JAXP implementation on the
classpath. The exporter performs an output-only identity transform, so
the serialized GraphML is unchanged.
Changes:
- Add the commons-secure-xml dependency (1.0.0-SNAPSHOT until its first
release).
- Route factory creation through SecureTransformerFactory in
GraphMLExporter; its wrapper extends SAXTransformerFactory, so the
existing cast keeps working.
- Declare the use-apache-snapshots profile locally (this POM's parent
chain, org.apache:apache:33, predates it) and run the CI build with
-Puse-apache-snapshots so the commons-secure-xml SNAPSHOT resolves.
Assisted-By: Claude Fable 5 <no...@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MHgnMnGWHQoH2zD2jFdoMT
---
.github/workflows/maven.yml | 4 ++--
pom.xml | 24 ++++++++++++++++++++++
src/changes/changes.xml | 3 +++
.../commons/graph/export/GraphMLExporter.java | 4 ++--
4 files changed, 31 insertions(+), 4 deletions(-)
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 2a01ceb..408ec16 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -63,6 +63,6 @@ jobs:
distribution: 'temurin'
java-version: ${{ matrix.java }}
- name: Build with Maven
- run: mvn --errors --show-version --batch-mode --no-transfer-progress install -D"maven.javadoc.skip=true" -D"org.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
+ run: mvn --errors --show-version --batch-mode --no-transfer-progress -Puse-apache-snapshots install -D"maven.javadoc.skip=true" -D"org.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
- name: Generate jacoco:report
- run: mvn --errors --show-version --batch-mode --no-transfer-progress jacoco:report # coveralls:report
+ run: mvn --errors --show-version --batch-mode --no-transfer-progress -Puse-apache-snapshots jacoco:report # coveralls:report
diff --git a/pom.xml b/pom.xml
index daa8cee..3e4c802 100644
--- a/pom.xml
+++ b/pom.xml
@@ -153,6 +153,11 @@
</properties>
<dependencies>
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-secure-xml</artifactId>
+ <version>1.0.0-SNAPSHOT</version>
+ </dependency>
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
@@ -314,6 +319,25 @@
</reporting>
<profiles>
+ <!-- Same as in org.apache:apache:34+; the parent of this POM predates it. -->
+ <profile>
+ <id>use-apache-snapshots</id>
+ <activation>
+ <property>
+ <name>apache.snapshots</name>
+ </property>
+ </activation>
+ <repositories>
+ <repository>
+ <id>apache.snapshots</id>
+ <name>Apache Snapshot Repository</name>
+ <url>https://repository.apache.org/snapshots</url>
+ <releases>
+ <enabled>false</enabled>
+ </releases>
+ </repository>
+ </repositories>
+ </profile>
<profile>
<id>rc</id>
<distributionManagement>
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 0c9e0d4..cf7cfa2 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -23,6 +23,9 @@
</properties>
<body>
<release version="0.1" date="201?-??-??" description="First release.">
+ <action dev="pkarwasz" type="fix">
+ Create XML transformers through org.apache.commons:commons-secure-xml, so GraphML export runs with XML secure processing enabled
+ </action>
<action issue="SANDBOX-510" dev="kinow" due-to="Amey Jadiye" type="fix">
Unit tests failures in recently migrated "Commons Graph"
</action>
diff --git a/src/main/java/org/apache/commons/graph/export/GraphMLExporter.java b/src/main/java/org/apache/commons/graph/export/GraphMLExporter.java
index 2a59386..e69b0ec 100644
--- a/src/main/java/org/apache/commons/graph/export/GraphMLExporter.java
+++ b/src/main/java/org/apache/commons/graph/export/GraphMLExporter.java
@@ -21,20 +21,20 @@ package org.apache.commons.graph.export;
import java.util.Map;
-import javax.xml.transform.TransformerFactory;
import javax.xml.transform.sax.SAXTransformerFactory;
import javax.xml.transform.sax.TransformerHandler;
import javax.xml.transform.stream.StreamResult;
import org.apache.commons.graph.Graph;
import org.apache.commons.graph.Mapper;
+import org.apache.commons.xml.secure.SecureTransformerFactory;
import org.xml.sax.helpers.AttributesImpl;
final class GraphMLExporter<V, E>
extends AbstractExporter<V, E, GraphMLExporter<V, E>>
{
- private static final SAXTransformerFactory SAX_TRANSFORMER_FACTORY = (SAXTransformerFactory) TransformerFactory.newInstance();
+ private static final SAXTransformerFactory SAX_TRANSFORMER_FACTORY = (SAXTransformerFactory) SecureTransformerFactory.newInstance();
private static final String GRAPHML = "graphml";